How does product cybersecurity differ from information security in scope, challenges and focus areas?
Product security covers what is sold (devices, software, customer cloud services) and struggles with lifecycles, no access to live systems and many target markets. Information security covers the company's own IT and struggles with governance, asset inventory, monitoring and legacy infrastructure.
| Product cyber security | Information security | |
|---|---|---|
| Scope | Physical products sold to customers, mass-deployed software, cloud services provided to customers | Corporate IT, networks, servers and clients, corporate cloud |
| Challenges | Very short (IoT) to very long (OT) lifecycles; difficult access to live systems; manufacturer-customer relationship; diverse technologies; different target markets with different requirements | Awareness and governance; asset inventory; security monitoring; legacy infrastructure; complex enterprise architecture |
| Focus areas | SDL, secure coding, white-box testing, system architecture, vulnerability management | IAM, network security, policies and standards, hardening, enterprise architecture, scanning and patching, incident detection and response |
The root of the difference is ownership. Information security controls the systems it protects, so it can monitor, scan and patch them. Product security loses control at the point of sale. It cannot see the customer's installation or patch it at will. That is why it puts so much weight on getting the design and the code right before release.
Go deeper:
FIRST — PSIRT Services Framework — what a product security incident response team does that a corporate CSIRT does not